In a landmark judgement, the Court of Justice of the European Union struck down European Commission’s 2016 decision that held that the EU-US Data Protection Shield provides adequate protection to data of European users when it is transferred to the US. The Court held that when users’ personal data is transferred outside the EU by a data exporter located in the EU, users must be afforded the same level of protection guaranteed within the EU. This has to take into account the contract between the data exporter in the EU and the data processor in the third country, and how public authorities may access this transferred data.
The Court also ruled that EU countries’ individual data protection commissions must “suspend or prohibit a transfer of personal data to a third country” if the protection required by EU law cannot be ensured.
Maximilian Schrems, an Austrian citizen, had refiled a case with the Irish Data Protection Commission in 2018 following the CJEU’s 2015 judgement that said that the US did not offer an adequate level of protection against access public authorities to the data transferred to the country. This 2015 judgement is colloquially known as Schrems I. This case was then referred to the CJEU by the Irish High Court.
In response to this judgement, Schrems called it a “100% win – for our privacy”. “The US will have to engage in serious surveillance reform to get back to a “privileged” status for US companies,” he tweeted.
The full text of the judgement has not been released yet and is expected to be released later tonight.